Colegio María Inmaculada (CMI) Listed by medusalocker Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

On May 5, 2026, the MedusaLocker ransomware group listed Colegio María Inmaculada (CMI) on its public leak site and claimed to have taken internal files from the school. The number of individuals whose information may be involved remains unknown, and no further details about the volume or contents of the material have been released. For families, staff and former students connected to the Costa Rican Catholic school, the listing raises the possibility that personal or administrative records held by the institution could circulate without their knowledge.

Breaking down the breach

The only confirmed public record of the incident is the May 5, 2026 listing on the MedusaLocker site. The group states that files were taken from servers identified as CMI-DC01, CMI-APP, CMI-HTTP2, main-server1 and main-server2, associated with the domains cmi.local and mariainmaculada.ed.cr. No date of intrusion, encryption, or file transfer has been disclosed, nor has any ransom demand or payment been reported. The school has not issued a public statement confirming or denying the claims.

Who is medusalocker?

MedusaLocker is a ransomware operation that has been active since at least 2020. The group typically gains access through remote-desktop services or phishing, deploys encryption on Windows systems, and exfiltrates selected files before demanding payment. It maintains a leak site where it lists organizations it claims to have targeted, using the listings to pressure victims who do not pay. The group has previously listed entities in education, healthcare and local government. Its listing of CMI constitutes an unverified claim by the operators.

Who is Colegio María Inmaculada (CMI)?

Colegio María Inmaculada is a Catholic school located in Moravia, Costa Rica. Like other educational institutions, it maintains records on current and former students, parents or guardians, and staff. These records commonly include names, contact details, academic histories, attendance information and, in some cases, limited financial or health-related data required for enrollment or operations. A breach at such an organization can affect individuals across multiple age groups and time periods.

The information in question

The listing refers only to “internal files exfiltrated in ransomware attack.” No inventory of file types, document categories or data fields has been published. Schools of this kind routinely store enrollment forms, academic transcripts, staff employment records and limited financial information. The precise contents of any material allegedly taken from CMI remain unconfirmed.

Why it matters

Even without Reported Details on the number of records or their sensitivity, the exposure of internal school files can create long-term privacy and administrative risks for the people named in them. Students and families may face identity misuse or unwanted contact; staff records can contain employment or payroll details. The school itself may incur costs for investigation, notification and system restoration, regardless of whether the group’s claims are later verified.

If your data was in this claimed breach

Exact exposure cannot be verified from public information. Individuals connected to the school can take the following steps:

• Monitor email and postal addresses associated with the school for unusual activity.
• Change passwords for any accounts that used the same credentials as school-related services.
• Review credit or bank statements for unrecognized transactions.
• Contact the school directly to ask what steps it is taking and whether it will provide notification if more information becomes available.
• Run a free exposure scan of their email address against known breach data sets to check for appearances in other incidents.

AICompiled with AI assistance from public sources and published under our editorial standards.